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Abstract — q-ary lattices can be obtained from g-ary codes using 
the so-called Construction A. We investigate these lattices in the 
Lee metric and show how their decoding process can be related 
to the associated codes. For prime q we derive a Lee sphere 
decoding algorithm for q-ary lattices, present a brief discussion 
on its complexity and some comparisons with the classic sphere 
decoding. 

I. Introduction 

A q-ary lattice p3) , p9[ is an integer lattice in the Euclidean 
space M" which contains gZ" as a sublattice. It can be 
obtained via Construction A Q from a linear code in the 
module Z^'. Those lattices have deserved special attention 
in recent years due to their use in cryptographic schemes 
based on lattices, one of the so-called "post-quantum" methods 
p?) , |16|. One important problem concerning general lattices 
(thus particularly q-ary lattices) is the CVP (Closest Vector 
Problem) which asks for the closest lattice point to a received 
point in M". A method largely used to solve this problem 
in the Euclidean metric is the sphere decoding L7J, | ,20J , 
pT) , which has exponential expected complexity pl| . Other 
methods include basis reductions such as LLL |14| and BKZ 
|[T8J, and trellis algorithm ||3J. 

Codes in the Lee metric, on the other hand, were introduced 
in | [T3| and since then have been the object of study of 
many works from both theoretical (e.g. |[T|, ||6), |[8J, y_2J) and 
practical (e.g. Q, p7) ) points of view. The Lee metric has 
a close relation with the li metric, also called Manhattan or 
Taxi Cab metric, explored for example yj, 1|8J, concerning the 
existence of perfect codes and more recently where the 
authors show how to construct dense error-correcting codes in 
the Lee metric from dense lattice packings of n-dimensional 
cross-polytopes. 

The contributions in this paper are organized as follows. 
In Section III we derive connections between a q-ary lattice 
and its associated code decoding processes in the Lee metric 
through Propositions ([TJ and (|2]i. This illustrates the fact that 
the Lee metric seems to have a "natural" geometry when deal- 
ing with g-ary codes (and lattices) for q E N, q > 3. In Section 
IV we propose an adaptation of the traditional sphere decoding 
ideas for q-ary lattices (q prime) in the Lee metric and discuss 
its expected complexity through arguments which are similar 

Work partially supported by FAPESP* under grant 2009/18337-6, CNPqt 
140239/2009-0, CNPq^ 309561/2009-4 and FAPESP 2007/56052-8 



to the ones presented in fTT\. Using geometric arguments, we 
also make some comparisons with the classic sphere decoding 
and perform some low dimensional simulations. 

II. Preliminaries 

In this section we summarize some concepts and properties 
related to q-ary lattices, Lee metric and establish the notation 
to be used from now on. 

A. q-ary lattices 

Given q £ N, a q-ary linear code C is a Z^-submodule of 
Z^'. For prime q, there is always a generator matrix for C in 
the systematic form, i.e., A^xk ^ [hxk \ ^Ln-fe]*- 

A lattice A is a discrete additive subgroup of M". Equiva- 
lently, A C M" is a lattice iff there are linearly independent 
vectors Vi,...,?;,,, e M", such that any y E A can be 
written as y = jy^^iCtiVi , G Z. The set {vi, . . . ,Vm} 
is called a basis for A. A matrix AI whose columns are 
these vectors is said to be a generator matrix for A. Given 
a metric d in M", the Voronoi region of a; e A is the set 
V{x) = {y e W;d{y,x) < d{y,x*), for all x* e A}. To 
decode y E M" is to find the closest lattice point to y. 

The so-called Construction A extended for q-ary codes p9) , 
can be described by the surjective map (f) : Z" — > Z^, 
(j>{xi, . . . , Xn) = i'xi, ■ ■ ■ ; x^)- Given a linear code C C Z^, 
Aq(C) = 0~^(C) is said to be the q-ary lattice associated 
to C and Kq{C) / q'E'^ ~ C. The code C can be viewed as 
the set of representatives of the above quotient inside the 
hypercube [0,q)" and Aq(C) is given by translations of this 
set by multiples of q in each direction. For q prime, Aq(C) is 
generated by the matrix: 

^y- _ Ikxk Ofcx(n— fe) ^j-j 

[ B(n-k)xk <ll(n-k)x(n-k) J 

provided that [Ikxk \ Bkxn-k\* '■^^ associated generator 
matrix for C. 

B. Lee metric 

Instead of the usual Hamming metric for codes and Eu- 
clidean for lattices we consider here the Lee metric for both 
spaces which seems to be more natural when dealing with 
q-ary lattices and codes. 



For X = (xi,...,a;„),y = (yi,---,2/n) e IR", the Zi 

n 

or sum distance is defined as di-^{x,y) = ja^i — yi\. 

i=l 

The Lee distance in either Z'^ = Z/gZ" or M"/qZ" 
is the distance induced by dj^ through the quotient map: 

n 

dLee{x,v) = ^ min{a;i - (mod g), y,; - (mod q)} . 

We will denote here either di^ or d^ee by d and call 
both Lee distance. The minimum norm /i of a lattice A is 
ji — min d{x,Q) and for a g-ary lattice A^(C) we have 



/x = min{g,d(C)} |[T9). 

III. Decoding q-ary lattices via Construction A 

A decoding process for lattices constructed from binary 
codes via Construction A is presented in Q. It is shown that 
decoding a binary code C C Z^ corresponds to decoding in 
the binary lattice h.2{C) C in the Euclidean metric. In this 
section we obtain the same kind of relation between code and 
lattice decoding with the Lee metric. 

Let C C Z!J be a 
A,(C)/gZ- 



^ „ g-ary code. Due to the isomorphism 

C, we will not distinguish the elements of 



Aq(C)/(7Z" from codewords of C and we will denote by [J 
the rounding to the nearest integer. Given a received vector 
r G K", let z be its closest point in Aq{C) considering the 
Lee metric. In the next Propositions ([TJ and Q, we show how 
to find via Construction A a representative of z which is given 
by a codeword in C. 



[ri,. 

X e 



Proposition 1: Let \{C) be 
M" a received 



.,r-„)* e : 

A,(C)M'^ 



a g-ary lattice and r = 
vector. Given an element 
* the 



representative 



z = (0i,...,2„)* e Aq{C) of X which is closest to r 
A.q{C) considering the Lee metric is given by Zi — 



in 



where Wi — 



qwi 



for each i = 1, . 



Proof: The proof is straightforward. A representative of 
the class of x is given by 2; — a; + qw, where w E Z" and 
the Lee distance d{r, z) = X]"=i Vi ~ — qwi\ is minimum 
when Wi = 



Proposition 2: Let Aq{C) be a g-ary lattice. Given r = 



in, 



fn)* G IR" a received vector let r (mod q) e [0,q)' 



obtained from r by reductions modulo q in each entry. If S e 
C is an element of C closest to r (mod q) considering the 
Lee metric, z E Aq{C), z — x, given by Proposition ([T]) is a 
lattice point nearest to r. 

Proof: Let r = (ri,...,r„)* = (ri*, . . . , r„*)* + 
q{ti, . . . , tnY, with < ri* < q, ti E Z, for i = 1, . . . ,n, 
that is r (mod (7) — (ri*, . . . , r„*)*. Let x E x = 
(xi, . . . , XnY, < Xi < q ~ I for i — 1, . . . ,Ti, he a closest 
point to r (mod q) considering the Lee metric. We will show 
that a closest point to r in A is in the same class that x 
in Aq(C)/gZ". For each class a E C, a — (ai, . . . , a„)*, 
by Proposition ([T]l we find the representative a* closest to 
r considering the Lee metric. We will show that d{r,a*) = 




Fig. 1: Decoding r = (0, -6) E 
d{r (mod q), a). For the Lee distance we have 

n 

d{r, a*) = ^ \ri* - - a^g], 

i=l 



where ai - 
because Ir 



Since — 1 < 



< 1 



q \ J — q 

o-i\ < q, then ai E { — 1,0,1}. Now, we can 
observe that if = for some i, then —q/2 < ri* —Ui < q/2 



and this implies min{|7 



ai = 1 for some i, then q/2 < 

- \r* - a,\} = q - \r* 



ai\,q- \r* -a^l} = \r* - a,\. If 
~ai < q and then min{|r* — 

= - ai. 
ai < -q/2 



ai\ and \r* — a. 
Finally, if ai ~ —1 for some i, then —q < ri* 
and then min{|r* —Oil, g— |r* —flil} = g— |r* —Oil and \r* — 
"il = -{r* - ai). So, d{r,a*) = X^-Li ki* - ^i - a,q\ = 
X^-Li min{|ri*-ai|,g-|ri*-aj|} = d{r (mod q), a). Since 
X satisfies d{r (mod q), x) = mm{d{r (mod q), a), a E 
C} then z satisfies d{r,z) — mm{d{r , y) , y E Aq{C)}. ■ 
Example 1: Consider the cyclic 13-ary code in Zfg, C = 
((T,5)*) . It has minimum Lee distance d{C) — 5 and error 
correction capacity i = 2. For the received vector r — (0, —6)* 
the Lee-closest codeword to r (mod q) = (0, 7)* is a; = 
(12,8)*. Hence in Proposition ([TJ, wi = 11)2 = —1 and by 
Proposition (|2]) the closest lattice point to r is 2; (—1, —5)*. 
Figure (1) shows the lattice Ai3(C) and its Voronoi regions. 

Example 2: Consider C the BCH code defined in the ring 
<fix)> . where f{x) = + 



1 with parity-check matrix 



1 

a 



1111 



a 



a 



where a = and /3 is a root of f{x) |j2j. We can derive a 
generator matrix for the 4-ary lattice A = (/)~^(C) as 

/1000000\ 
1 

1 
2 1 3 4 

1 3 2 4 
1 1 1 4 

\32iOOO4y 



Let r = (0,7,4,8,0,12,0)* be a received vector. The 
closest code point to r (mod 5) = (0,3,0,0,0,0,0)* is 
X = (0,0,0,0,0,0,0)*. Hence in Proposition ([l}, wi = 0, 

W2 = [|] =2,W3^ [|] ^ l,Wi = [|] =2,W5= 0, 

We = [^] = 3 and W7 = 0. Then, z = (0, 0, 0, 0, 0, 0, 0)* + 
4(0, 2, 1, 2, 0, 3, 0)* = (0, 8, 4, 8, 0, 12, 0)* is the closest point 
to r. 

Proposition Q provides a decoding process for q-ary lat- 
tices with the Lee metric via its generator code. This can 
be specially interesting for associated codes with an efficient 
Lee decoding algorithm. Decoding algorithms for some g-ary 
codes in the Lee metric assuming integer coordinates for the 
received point r can be found in ||T|, | [T2| , fTT) . The algorithm 
derived in the next section is based only on the lattice structure 
and allows real coordinates for r. 

IV. Lee Sphere Decoding 

The algorithm proposed here is analogous to the classic 
sphere decoding in the Euclidean metric and follows the same 
basic ideas. Nevertheless, we show that the structure of g-ary 
lattices in the Lee metric yields some important simplifications 
in comparison to the traditional algorithm. From now on, 1 1 . | 
will always stand for the Lee norm. 

Let Ag(C) be a g-ary lattice with generator matrix M in the 
special form given in ([T]l and r a received point. We remark 
that Ag(C) always have a generator matrix in that form for 
q prime and in some cases for q not prime, as can be seen 
in Example (|2]i. Given i? > we want to enumerate all y E 
Aq{C) such that ||y - r|| = ||Afa;-r|| < R and then find 
the closest lattice point to r. 

Fixing the vector = {xi, . . . ,XkY, the minimum of 
||Afa: — r|| is obtained by simply taking 

= - iBx^)j^k)/q\ (j - fc + 1, . . . , n), (2) 

what can be seen as a consequence of proposition ([T]i. Hence, 
in order to decode the received vector r, it is not necessary to 
enumerate all lattice points inside the Lee sphere above-cited, 
which allows us to discard many points during the enumeration 
step by choosing the exact path of the sphere decoding tree 
||n I that leads to the minimum norm value, given the first k 
nodes (Figure (|2|). 

The lattice points tested by the algorithm are those whose 



coordinate vector x satisfies Ij < xj < uj, (j — 1, 



where 



R + T, 



-R 



El 

4=1 



and 



i-i 

El 

4=1 



■ k). 



(3) 



i.e., the points satisfying Ha?-*- — (ri, . . . , rfc)|| < R. In this 
case, the number of feasible points corresponds to the number 
of Z'^ points inside a Lee sphere of radius R centered at r, 
which we estimate by the volume of the sphere, i.e., R^2*' /k\. 
There is a subtle difference between feasible points and nodes 
visited by the Lee sphere decoding algorithm which will 




Fig. 2: Lee sphere decoding tree for Aq(C) where C is the 
BCH code in Example dgh, r (1, 1, 1, 5, 2, 3, 5)*, and i? = 2. 



become clear later. If we continue the search until depth n we 
will get an estimated number of feasible points as i?"2"/ri!, 
which, for n much larger than k represents a drastic reduction. 
We can now describe the algorithm of the search done in 
a node at depth j < k as the enumeration of all Z*^ in 
the Lee sphere centered at (ei,...,efc) with radius R. For 
j = fc + 1 we choose Xj according to Equation (|2| and check 
if 1 1 Af a; — r 1 1 < R. In order to speed up the search some 
backtracking strategies for updating the decoding radius are 
also possible, but we will not consider those in our discussion 
on the complexity of the algorithm. 

Remark 1: We remind that in the classic sphere decoding 
there are no restrictions on the generator matrix M in order to 
perform enumerations, since it is possible to triangularize M, 
for example, via QR factorization where Q is an orthogonal 
matrix. Unfortunately this approach cannot be employed here 
since rotations are not isometrics in the Lee metric. Thus, the 
"systematic" form ([T]) of the generator matrix for Aq(C) is 
crucial in the process above-described. 

A. Choosing the decoding radius 

The radius choice is a critical part of sphere decoding. For 
the Euclidean case, Viterbo and BigUeri pO| first proposed the 
covering radius of a lattice, which can be estimated by Roger's 
bound. Hassib and Vikalo 1 1 1 1 suggested that the radius could 
be chosen accordingly to the signal-to-noise ratio (SNR) of 
the channel. Another possible strategy is the so-called Babai's 
estimate which can be easily adapted to the Lee norm. The 
stategy is to take: 



R = \\M [a;] - r\\ 



(4) 



where x is the (real) solution of Mx = r and [a;] is the 
vector whose coordinates are a;'s entries rounded off to the 
closest integer. This estimate guarantees at least one lattice 
point inside the Lee sphere of radius R and allows us to take 
advantage of the interesting structure of q-aiy lattices. For this 
estimate and matrix M as in ([T]), we have: 



R < 



k q{n — k) 



(5) 



Therefore, if fij is the number of visited nodes at depth- 
j (corresponding to the number of Z'^ points inside the 
ball 11(2:1 — ri, . . . ,Xj — rj)\\ < R), we have the following 



equation as an upper bound for the expected number of nodes 
visited by the algorithm until depth k: 



E[# of nodes] = X! - XI 



(j + q{n- j)y 



(6) 



In fact, reasoning in the same way as pT| , we can argue that 
R w k^+^/^ /2e for large k and hence the expected complexity 
of the algorithm is exponential, which is inherent to problem 
itself. 

In the special case that the received vector is in Z" (or at 
least the first k coordinates of r are integers) we have the 
following: 

Proposition 3: Suppose the received vector r is such that 
(ri,...,rfc) e Z*^. Then the number of nodes of the Lee 
sphere decoding tree until depth k is exactly 



k m\n{j,R} . . 



R 



(7) 



Proof: The proof comes from previous arguments of this 
section and the fact that the number of points of V inside a 
Lee sphere of radius i? is fS): 



min{j,_R} 
i=0 



(8) 



B. Comparisons 

There are several efficient algorithms to solve (exactly or 
approximately) the Euclidean version of CVP. A first approach 
to approximately solve the Lee sphere decoding problem 
could be through the so-called Nearest Plane Algorithm p6[ 
which essentially projects the target vector on a LLL reduced 
basis for the lattice. This approach yields a polynomial time 
algorithm with an exponential approximate factor. If used 
to approximate CVP in the Lee metric, the Nearest Plane 
Algorithm outputs a vector which satisfies: 



< 



\y - ^1 



(9) 



2/2 

where y G A is the closest point to r in the Lee norm and 
the \l\fn factor is, of course, explained by the equivalence 
relation between the l\ and I2 norms. 

Concerning the comparison with the classic sphere decod- 
ing, we will not go into detail on the number of arithmetic op- 
erations performed by the algorithms, and let this more careful 
analysis for a further work. However, since the performance 
of the algorithm is closely related to the volume of the spheres 
involved in the process, it is worth to study whether the Lee 
sphere has a smaller volume than the Euclidean one, given a 
received point and its Babai estimate (in both norms). In what 
follows we show that when the dimension (k) increases, the 
Euclidean spheres have greater volume than the Lee spheres, 
in average. 



Stating the problem more formally, let r — Mx + e be a 
received point and Ri and R2 the Babai's estimate to the de- 
coding radius in Lee and Euclidean norm, respectively. Clearly 
^1 > R2. We want to know whether Vol(BLee(^i)) > 
'Vol{BEucHdiR2)) in average or not, where Vol(S) stands for 
the Euclidean volume of a set S. Without lost of generality 
we assume that the transmitted point is the origin. If we fix 
the value R2 and take the average volume of all Lee spheres 
centered at the origin and containing a point of the surface of 
the Euclidean sphere of radius R2, we have: 



Vol(Siee) = 



/ • • ■ /s VLee(01, • ■ • , 0n-l)#l • • ■ 0n-l 

(7r/2)"-i 



n!(7r/2)"-i J "Js 



{Xi + ...+ X„)"d0i . . . (f>n-l 



(10) 



where (xi, . . . , x„) is in the surface S of the Euclidean sphere 
and the angles ^1, . . . , (/)„ are the hyperspherical coordinates. 
If we define 



{Xi + ...+ XnY 



(11) 



the following expressions can be derived: 



/(n, n) 



3=0 

Vol(Biee) 

We can then show that 



2r(f + 1) 



i??2" 



/(n-l,j)and (12) 



n\{TT/2y 



;Y/(n,n) 



/(n,n)2"/(n!(V2)"-i) 
i-™oo 7r"/2/r(n/2 + 1) 



(13) 



(14) 



what means there is a value Uo such that for all n > Uo, we 
have Wol{BLee) < '^o^B EucUdiRi)) ■ We illustrate this fact 
in Figure |3] 

Remark 2: It is a well-known fact that the ratio between 
the volume of a sphere in the li norm and a Euclidean sphere 
of the same radius vanishes while increasing the dimension. 
This fact, however, does not imply Equation ([14]), since the 
spheres considered here have different radius. 

C. Simulations 

To simulate what was proposed in the previous sections we 
considerer received vectors of the form: 



Mx 



(15) 



where M is in the form ([TJ, the entries of its submatrix B 
are uniform on and the entries of e are i.i.d. zero mean 
random variables with Laplace distribution. Our choice of this 
noise instead of the usual Gaussian noise is explained by the 
relation of Laplace distribution with the li norm. Indeed, while 
Gaussian noise samples are Euclidean spherical distributed 




10 

Dimension 



Fig. 3: Volume of the unitary Euclidean sphere and average 
volume of Lee sphere (Equation ( [T3| ) for R2 = 1) versus 
dimension. 



around the transmitted point, Laplacian noise samples are Lee 
spherical distributed. Channels with Laplacian noise have been 
investigated in some works (e.g. pO) ) as a case of general 
channels with additive noise. Figure |4] shows simulation in 
dimensions up to 17. 
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Fig. 4: Simulation results for fixed n = 17, g = 5 and k from 
1 to 16. 
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V. Conclusion 

Connections between the decoding process on codes and 
lattices may provide tools for error correcting codes and 
cryptographic schemes. We discuss here this connection in 
the case of g-ary lattices, which are obtained from q-ary linear 
block codes through Construction A, considered with the Lee 
distance, and present a Lee sphere decoding algorithm for 
lattices. Extensions of the presented approach here to other 
constructions of lattices will be considered in a future work. 



